You send an important email — an invoice, a password reset, a sales follow-up — and it never arrives, or it lands in spam. The cause is almost never the message itself. It is the invisible plumbing behind your domain: the DNS records that tell the world how to reach your website and, crucially, how to verify that your email is genuine. Get those records wrong and even legitimate mail looks suspicious. This guide explains DNS and the three email-authentication standards — SPF, DKIM, and DMARC — in plain language, and how free tools help you check and fix them.
If you want to diagnose your domain right now, 530.tools bundles DNS lookups and email-authentication checks alongside its SEO utilities, so you can see exactly which records are present, missing, or misconfigured. (For the search side of the suite, see our guide to the free SEO tools suite.)
DNS in One Minute
DNS — the Domain Name System — is the internet's address book. When someone types your domain, DNS translates it into the server addresses that actually serve your site and route your mail. A handful of record types do the heavy lifting: A and AAAA records point your domain at a web server's IP address; CNAME records alias subdomains and third-party services; MX records tell the world which mail servers handle email for your domain; and TXT records hold text-based settings — including your email-authentication policies. If a record is missing or wrong, the corresponding service quietly fails.
SPF: Who Is Allowed to Send Your Mail
SPF (Sender Policy Framework) is a TXT record listing the mail servers permitted to send email on behalf of your domain — your own mail server, your marketing platform, your CRM, your helpdesk. When a receiving server gets a message claiming to be from you, it checks the sending server against your SPF list. If the sender is not listed, the message looks like a forgery. A common pitfall is forgetting to add a new service (so its mail starts failing), or exceeding SPF's limit of ten DNS lookups, which invalidates the whole record. A checker catches both.
DKIM: A Tamper-Proof Signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message. Your mail server signs outgoing email with a private key, and the matching public key lives in a DNS TXT record at a named "selector." The receiving server fetches that public key and verifies the signature, proving two things: the message genuinely came from your domain, and it was not altered in transit. If the DKIM record is missing, the selector is wrong, or the key was rotated without updating DNS, the signature fails and your mail loses trust.
DMARC: The Policy That Ties It Together
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instruction manual that sits on top of SPF and DKIM. Its TXT record tells receiving servers what to do when a message fails authentication — do nothing (p=none), send it to spam (p=quarantine), or reject it outright (p=reject) — and where to send aggregate reports so you can see who is sending mail using your domain. Start at p=none to monitor, read the reports to confirm your legitimate senders all pass, then tighten to quarantine and eventually reject to shut out spoofers. Skipping straight to reject before checking the reports can block your own mail.
"SPF says who may send, DKIM proves the message is untouched, and DMARC decides what happens when either check fails. Get all three right and your email earns the inbox; leave one out and you are gambling with deliverability."
— ESS ENN Associates IT Infrastructure Team
A Practical Checklist for Deliverability
1. Look up your current records. Use a DNS and email checker to read your SPF, DKIM, and DMARC TXT records and your MX records.
2. Fix SPF. Make sure every service that sends mail for you is included, and that you are under the ten-lookup limit.
3. Confirm DKIM. Verify the selector your mail provider uses resolves to a valid public key.
4. Set DMARC to monitor. Publish a p=none record with a reporting address, then review the reports.
5. Tighten gradually. Once your legitimate mail passes, move DMARC to quarantine, then reject.
6. Re-test after every change. DNS changes take time to propagate; re-run the checker to confirm.
Why DNS and Email Belong in the Same Toolkit as SEO
It might seem odd that an SEO suite also checks DNS and email — but they share the same foundation. Search crawlers and mail servers both rely on correct DNS to find and trust your domain. A misconfigured DNS zone can hurt both your rankings and your deliverability at once. Having SEO, DNS, and email diagnostics in one place, as 530.tools does, means you can verify the whole health of your domain in a single pass rather than chasing problems across separate tools. For organisations that need this managed properly and continuously, our DevOps and infrastructure team and managed cloud services handle DNS, deliverability, and security as part of a reliable operations setup.